NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-123573 — Hickory-Dns

HIGH

CVE-2026-123573 is a high-severity (CVSS 7.5) Improper Input Validation vulnerability in hickory-dns hickory-dns. A fix is available — see the affected versions and patch details below.

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.

Affected Products

1 product · 1 configurations
Application
hickory-dnshickory-dns
< 0.26.2
1 version
0.20.1

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every hickory-dns hickory-dns deployment and check each version against the affected-products list above.

  2. Fix

    Apply the hickory-dns hickory-dns security patch or hotfix for CVE-2026-123573 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes the parsing process.
O3 Security · Runtime Protection

Is CVE-2026-123573 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2026-123573: Hickory-Dns (High 7.5)